Data detection and protection policies for electronic file systems

ABSTRACT

Systems and/or methods for deploying and implementing data loss prevention (DLP) policy definition that may encapsulate the requirements, control objectives and directives, and/or the definitions of sensitive data types as stipulated directly or indirectly by the regulatory policy are disclosed. In one embodiment, DLP policies may be identified by an organization to run on top of a set of electronic file systems (e.g., email systems, file systems, web servers and the like). Organizations and their administrators may implement a set of DLP policy instance which are derived from DLP policy templates. DLP policy templates may comprise both structure and meaning—and may acquire a given DLP policy by the replacement of parameterized expressions with desired parameter values. In another embodiment, the state of the DLP policy instance may change according to the lifecycle of the policy instance deployment.

CROSS REFERENCE TO RELATED APPLICATION

The present application is a continuation application of and claimspriority of U.S. patent application Ser. No. 13/545,864, filed Jul. 10,2012, the content of which is hereby incorporated by reference in itsentirety.

BACKGROUND

Modern organizations find it desirable to find, monitor, and protectsensitive information (e.g., in electronic form)—such as PII, FinancialData, Intellectual Property, and Health data in e-mail. In order to dothis, organizations attempt to model both the data that should beprotected—as well as the policies that should be applied to the data.For e-mail, administrators attempt to select different scoping mechanismfor their policies such as sender identity, recipient identity, andothers.

In addition, administrators attempt to select and apply actions such asaudit, encrypt, require TLS transmission, etc. Also, administrators tryto take policies that are related to a single objective such asregulatory objective and may try to manage them as a single package,even though policies may contain different rules, and enable/disable andtest policy in a single action.

SUMMARY

The following presents a simplified summary of the innovation in orderto provide a basic understanding of some aspects described herein. Thissummary is not an extensive overview of the claimed subject matter. Itis intended to neither identify key or critical elements of the claimedsubject matter nor delineate the scope of the subject innovation. Itssole purpose is to present some concepts of the claimed subject matterin a simplified form as a prelude to the more detailed description thatis presented later.

Systems and/or methods for deploying and implementing data lossprevention (DLP) policy instances from a policy object model aredisclosed. In one embodiment, DLP policies may be identified by anorganization to run on top of a set of electronic file systems (e.g.,email systems, file systems, web servers and the like). Organizationsand their administrators may implement a set of DLP policy instance bythe parameterization of DLP policy templates. DLP policy templates maycomprise both structure and meaning—and may be affected by thesubstitution of generic policy configuration with deployment specificenvironment configurations at time of policy creation by the replacementof parameterized expressions with desired parameter values. In anotherembodiment, the state of the DLP policy instance may change according tothe lifecycle of the policy instance deployment.

In one embodiment, a method for instantiating a DLP policy from a set ofpolicy templates is disclosed, the steps of the method comprising:identifying an electronic file system upon which a desired DLP policy isto be affected; identifying a set of DLP policy templates suitable forthe desired DLP policy; parameterizing the DLP policy templates withdesired DLP Policy-specific data; and disseminating the parameterizedDLP policy instance to the electronic file system.

In another embodiment, a system for creating at least one DLP policyinstance for a set of electronic file systems is disclosed, comprising:a set of DLP policy templates; each of the DLP policy templatescomprising a set of component fields; a DLP policy templateparameterization module, the template parameterization module capable ofreplacing the component fields with desired policy data; and a DLP mainpolicy module capable of creating a DLP policy instance for a set ofelectronic file systems from the set of DLP policy templates.

Other features and aspects of the present system are presented below inthe Detailed Description when read in connection with the drawingspresented within this application.

BRIEF DESCRIPTION OF THE DRAWINGS

Exemplary embodiments are illustrated in referenced figures of thedrawings. It is intended that the embodiments and figures disclosedherein are to be considered illustrative rather than restrictive.

FIGS. 1, 1A, and 1B (collectively referred to as FIG. 1) depicts oneembodiment of a system that affects policy systems as made in accordancewith the principles of the present application.

FIG. 2 depicts one embodiment of an implementation and operation of apolicy system in the context of e-mail as made in accordance with theprinciples of the present application.

FIG. 3 depicts one embodiment of a system mail server processingsubsystem as it may interface with a policy system in the context ofe-mail.

FIG. 4 is one embodiment of one exemplary DLP policy template, as itmight be represented for a putative customer email system.

DETAILED DESCRIPTION

As utilized herein, terms “component,” “system,” “interface,” and thelike are intended to refer to a computer-related entity, eitherhardware, software (e.g., in execution), and/or firmware. For example, acomponent can be a process running on a processor, a processor, anobject, an executable, a program, and/or a computer. By way ofillustration, both an application running on a server and the server canbe a component. One or more components can reside within a process and acomponent can be localized on one computer and/or distributed betweentwo or more computers.

The claimed subject matter is described with reference to the drawings,wherein like reference numerals are used to refer to like elementsthroughout. In the following description, for purposes of explanation,numerous specific details are set forth in order to provide a thoroughunderstanding of the subject innovation. It may be evident, however,that the claimed subject matter may be practiced without these specificdetails. In other instances, well-known structures and devices are shownin block diagram form in order to facilitate describing the subjectinnovation.

Introduction

Several embodiments of the present application disclose systems, methodsand mechanisms that allow policies to be created for electronic filesubsystems (for merely one example, e-mail) and model them as a set ofrelated objects that can be installed, removed, state changed, andreported from at the same time in a single operation. While the presentembodiments are more drawn to examples of e-mail systems, it should beappreciated that the systems, methods and/or techniques described hereare also applicable to a wide variety of electronic file systems in abroad sense—e.g., file systems, information protection and collaboration(e.g. Microsoft Sharepoint® system), web servers, application serversand the like.

As will be discussed in more detail herein, in many embodiments, itwould be desirable to employ a framework to model complex industryregulations or company information governances as a policy. Broadly,these policies—and their associated systems and methods—are generallydescribed in area of Data Loss Prevention (DLP). Applications in thisarea may implement all or partial components that address the policyprocessing as it applies to: (1) managing the policy lifecycle; (2)enforcing and evaluating the policy at policy enforcement points; (3)generating and viewing reports and (4) managing violations for incidents

One Embodiment

FIG. 1 is a schematic diagram of a policy system as made in accordancewith the principles of the present application. As may be seen in thisembodiment, there may be several general policy modules that may workwith various electronic storage and/or servers that may be set across agiven organization. Broadly, there may be a Policy Management System,multiple policy enforcement points, and an Audit System for the settingand testing of a policy, respectively.

As may be seen in FIG. 1, Policy Management System 100 may comprise apolicy authoring system 102, a policy store 104, a policy disseminationsystem 106. As will be discussed in further detail herein, these policymodules may be employed to set and disseminate a policy for theorganization. Policy may be affected by various policytranslation/mapping systems 108—which understand the generic policydirectives and transform them to the contextually understood format bythe policy enforcement points, which may interface with variouselectronic data subsystems—e.g., Mail Delivery Systems 110, mail clientsystems like Microsoft Outlook® system 112, information managementsystems like Microsoft Sharepoint® system 114, File Systems 116, WebServers 118 or other suitable electronic data subsystems that arecapable of policy enforcement and application.

Within these policy enforcement subsystems, there may be modules thereinthat implement the policies effectively within the subsystems. Forexample, such modules may be policy consumption, local contextualprocessing—which may further comprise contextual policy evaluation,contextual policy enforcement, and contextual policy presentation.

As a part of these subsystems, it may be desirable to have a contextualaudit data generator. These audit data generators may be incommunication with an audit aggregation system 122 and an auditpresentation system 124.

It should be appreciated that many other architectures are possible forimplementing a policy system that may interface with an organization'ssoftware suite—e.g., email, file servers, web interfaces and the like.In addition, it may be possible (and maybe desirable) for certain policymodules (for example, the policy authoring and store, and auditfunctions) to be hosted apart from the organization and suppliedotherwise (e.g., server/client relationship, cloud-based services or thelike).

Once a policy system is implemented or otherwise configured for anorganization, such policy systems take on a runtime dynamic. FIG. 2depicts one embodiment of a runtime dynamic 200, as it might apply to anexemplary email flow policy application. The organization will typicallyhave its email system and/or server 202 prior to the implementation of apolicy system that will operated on top of, or otherwise cooperatively,with the email system.

The policy system may consume policy content from multiple sources. Onesuch source may be as supplied with the system itself in the form ofout-of-box (OOB) set of policy templates that are available as part ofthe product and may be acquired and installed by a tenant systemadministrator and/or other suitable users 206. Another source may befrom Independent Software Vendors (ISVs) and product partners, andconsultants that provide custom policy content for the consumption bythe target organization. 204 may supply the organization with custom DLPpolicies. In either case, administrator 206 may perform particularconfiguration of a DLP policy system—in this case, working with theorganization's email system. In addition to the installation/creation ofthe policy, it may be desirable that ongoing policy maintenance andtuning may be performed by in-house personnel or external contractors orvendors—such as the tenant administrator or by the ISVs, partners,and/or consultants. These may be represented by multiple operations suchas 206 and 204.

In operation, the policy directives may include operations in contextsthat the information workers interact with, such as Outlook 210 a orgeneric email client 210 b, that may result in the active educationand/or notification of the policy to the organization's users. Thepolicy directives would determine what content is considered sensitiveand define the rules governing its usage/handling within theorganization. Both, what is the sensitive content and rules governingits usage can be disseminated to the end users as part of the policydirectives. (e.g., email with patient information, trade secretinformation or the like). The policy directive may allow the user ofsending this information unrestricted, require explicit acknowledgementthat the communication contains sensitive information and the user takesresponsibility for its disclosure, or prevention of sharing outright.

Once received, email server may process the email according to the samepolicy definition for policy consideration, compliance and/or processingdirectly (or the policy system may be operating apart from the emailserver in a server/client relationship or the like). Once the email isscanned for sensitive content, additional actions may take place such asholding the email prior to sending outside the email server, theorganization or the like. Any non-compliance with policy (or periodreports of generally compliant email traffic) may be sent to an auditor212 for follow up. Such follow-up may be to retrain affectedemployees—or it may detect some error in the dynamic flow and/oroperation of the policy system. Any policy processing errors may bereferred back to either the system administrator or to the ISV forcorrection. The mail processing server will enforce that the policy wasuniformly applied no matter what client was used as part of theauthoring experience. If the policy requires sender acknowledgements,these may be enforced for presence or the mail will be rejected back tothe sender.

FIG. 3 is the e-mail server processing details of the policyapplication—e.g. exchange server (box 202 in FIG. 2). FIG. 3 depicts onepossible embodiment of a system mail processing subsystem 300 as it mayinterface with a policy system. The e-mail server's policy processingmay be performed by an agent that is activated at various stages of mailprocessing. One such agent could be the exchange transport rules agent302 which may employ processing of content analysis predicate 302 a inconjunction with schema for content analysis predicated 318. Transportrules may be stored in 316 and administrators/user may edit contentanalysis predicates with module 314 b via a UI 314.

The agent may interface with a message content and attachment textextraction module (referred to herein as “FIPS”) 306 and contentanalysis module to scan for sensitive content. FIPS may be affected as acomponent that does the content extraction and conversion to text (e.g.,both mail messages and attachments) and may pass the extracted contentinto the classification engine for analysis of any sensitive content asdefined by the policy directives. FIPS may comprise a text extractionengine 306 b and communication modules with text extraction engine andthe content analysis engine, 306 a and 306 c respectively. FIPS may bethe same as the DLP policy evaluation module—e.g., it may be constructedas a sub-component making up DLP policy evaluation—i.e., the one thatdoes text extraction which is then fed into the classification enginefor analysis for any sensitive information as defined by the DLP policy.

The text extraction module may interface (perhaps via a communicationprotocol 308) with the content analysis/scanning engine/module 310 whichmay perform the text analysis on the text identified with the e-mailbodies and any attachments. The text analysis engine may identifysensitive content based on the policy information which has been storedin the content rules store 312 such as AD. Such rules may be edited byadministrators/users via module 314 a via UI 314.

Data Detection and Prevention Policy Object Model Embodiment

The present systems, methods and/or mechanisms may be implemented by anobject model approach. In one such embodiment, the complexities of aregulatory policy may be represented through a policy template conceptwhich encapsulates the policy directives and controls and offers methodsfor its lifecycle management. It may be desirable to have the followingobjects defined and/or associated with an object model that may allowfor ease of implementation: (1) policy template objects that allow forthe installation of the policy and all associated objects; (2) a mainpolicy object that tracks shared metadata and state; (3) a set of policyrule objects, mapping to the policy object, which define the policydirectives as match conditions and actions for each policy and (4) dataclassification rule objects which define the structure of the sensitivedata that the policy, and the regulatory specification, specify assensitive data definitions.

For these various objects, it may be desirable to define and implementoperations that act upon these objects. For example, for an exemplarypolicy template object operations might comprise: (1) install, (2)instantiate, and (3) remove. Operations for a main policy object mightcomprise: (1) creating new policy object from template; (2) creatingnew, editing, deleting, and managing state changes through itslifecycle. As may be the case, each of these operations may have impacton multiple objects associated with the policy which themselvesimplement the policy directives as appropriate in any of the applicablepolicy enforcement points. In the case of a policy system for email,there may be a runtime behavior for email—that may be subject to thepolicy—across a number of policy enforcement points which may include:(1) e-mail client (2) e-mail server (3) e-mail storage system (4) e-mailprocessing gateways etc. Each of the policy enforcement pointsinterprets and applies the policy in accordance with the state of thepolicy as it relates to the policy deployment lifecycle which mayinclude (1) audit only evaluation of the policy (2) audit andnotification evaluation of the policy and (3) full enforcement of thepolicy directives.

DLP Policy Template Embodiment

In one embodiment, a DLP policy template is a component description thatidentifies the characteristics of the policy and how it is realizedusing components—i.e., a configuration for components. It may benon-environment specific—e.g., a stencil used to create a deploymentspecific version. In addition, it may not have any state since it isjust a definition. In addition, it may offer a very simple set ofoperations—such as Import, Export, Deletion and Query. In one possibleembodiment, the template may be authored using an XML document that maybe used to express the full construct of a regulatory policy in animplementation independent format, as depicted in FIG. 4.

In this embodiment, the Import operation may allow for the import of thedefinition. The Import operation may be provided for “out of the box”(OOB) policy definitions that are built into the system. In addition,Import may be used to provide updates version of the policy templatesfor an OOB policy templates. Further, the import may be used toincorporate into the system additional policy definitions that areprovided to meet custom regulatory objectives or organizational needs.These additional policy definitions may extend built-in policydefinitions or create brand-new policy definitions.

The Export operation may allow for the saving, backup and offlineupdates of the policy definitions. Export may provide access to theserialized version of the template and may be used to migrate thetemplate from one environment to another.

Deletion operation removes the policy definition from a deploymentenvironment. In one embodiment, it may not be desired that Deletion issupported for OOB definitions. Query operation may allow for thediscovery of the definitions for both OOB policies and any additionalpolicies that have been added into the system.

An Exemplary DLP Policy Template Parameterization

For merely one example, FIG. 4 depicts one putative set of DLP PolicyTemplate components 400 that might be implemented to realize exemplarycustomer email flow compliance, possibly based on specific regulations.As may be seen, the DLP Policy comprises a set of components (having anassociated structure 402 and meaning 404)—e.g., Publisher (406, 408),Version (410, 412), Policy Name (414, 416), Description (418, 420),Meta-Data (422, 424), Set of Policy Constructs (426, 428) and a set ofData Classification Packages (430, 432). It will be noted that a set ofmeanings may be associated with these components. In this example, theinterface for managing the DLP policy templates objects may bePowerShell or any suitable web interface.

In one embodiment, it may be desirable that the template definitionallow defining properties that may be mapped to deployment values attime the template is used to create a DLP policy instance. For example,two main properties may be defined that utilize this capability: (1)exception Distribution List (DL) which may be mapped to a default DLprovisioned within a DLP deployment and (2) a DLP reporting mailbox thatwill be used as the destination for notifications of any policyviolation detections.

DLP Policy Template Parameterization

In one embodiment, a simple property replacement mechanism may be usedto accomplish parameterization of fields in a template. The followingmay be desired for the replacement mechanism: (1) the ability to specifyparameterized expression for DLP policy construct elements in a DLPtemplate; (2) the ability to pass parameter values as part of DLPtemplate instantiation; (3) the ability to use parameterized expressionsin both OOB DLP policy templates and ISV created ones; (4) the supportfor Unicode strings in the DLP policy template definition and assubstitution character input; (4) the ability for API to discover whichproperties are parameterized in a template; (5) the ability to strongtype the parameterized properties in a template.

This mechanism may be implemented by a simple find and replace of namevalue pairs in a template. The template's DLP policy constructs wouldallow the specification of substation keys for which replacement valuesmay be provided. For example, the substation keys may be of the form: %%keyName %%, where keyName is an identifier. The interface may allow thepassing of a name value pair that will provide a mapping for eachkeyName to a value.

For merely one example, the following excerpt may be given from a policydefinition in the PCI-DSS DLP policy template, as shown in FIG. 4:

---------------------------------------------------------------------------------------------   <?xml version=“1.0” encoding=“utf-8” standalone=“yes” ?>   <dlpPolicyTemplates>     <dlpPolicyTemplate version=“15.0.3.0”state=“Enabled” mode=“Audit”>     <contentVersion>1</contentVersion>    <publisherName>Microsoft (Beta)</publisherName>     <name>     <localizedString lang=“en-us”>PII</localizedString>     <localizedString lang=“fr-fr”>PII</localizedString>     </name>    <description>      <localizedString lang=“en-us”>Detects thepresence of information considered to be PII in the U.S. This includesthe presence of data like SSN and Driver's License in email. Aftercompleting your testing, configure the rules in this program such thatthe transmission of information complies with your organization'spolicies. Examples include configuring TLS with known business partners,or adding more restrictive transport rule actions such as rightsprotection.</localizedString>      <localizedString lang=“fr-fr”>Détectela présence de l'information considérée comme PII aux États-Unis. Celacomprend la présence de données SSN et permis de conduire dans lecourriel. Après avoir complété votre test, configurez les règles dans ceprogramme tel que la transmission de l'information conforme auxpolitiques de votre organisation. Configuration de TLS avec lespartenaires commerciaux connus, ou ajouter des actions de règle detransport plus restrictives telles que la protection des droits desexemples.</localizedString>     </description>     <keywords>     <keyword>KeyWord1</keyword>      <keyword> KeyWord2</keyword>    </keywords>     <ruleParameters>      <ruleParameter type=“string”required=“True” token=“%%ReportSeverity-1%%”>      <description>      <localizedString lang=“en-us”>Parameter Description -reportseveritylevel#1</localizedString>       <localizedStringlang=“pl”>parametr opis - reportseveritylevel#1</localizedString>     </description>      </ruleParameter>      <ruleParametertype=“string” required=“False” token=“%%ReportSeverity-2%%”>     <description>       <localizedString lang=“en-us”>ParameterDescription - reportseveritylevel #2</localizedString>      <localizedString lang=“pl”>parametr opis -reportseveritylevel#2</localizedString>      </description>     </ruleParameter>     </ruleParameters>     <policyCommands>     <commandBlock>      <![CDATA[New-TransportRule -name “PII-outside”-comment “Monitors for PII content sent to outside the organization”-DlpPolicy “%%DlpPolicyName%%” -SentToScope NotInOrganization -MessageContainsDataClassifications @{Name=“US Social Security Number(SSN)”},@{Name=“Passport Number (U.S / U.K)”} -ReportSeverityLevel%%ReportSeverity-1%%]]>      </commandBlock>      <commandBlock>     <![CDATA[New-TransportRule -name “PII-within” -comment “Monitorsfor PII content sent inside the organization” -DlpPolicy“%%DlpPolicyName%%” - SentToScope InOrganization-MessageContainsDataClassifications @{Name=“US Individual TaxpayerIdentification Number (US ITIN)”},@{Name=“US Social Security Number(SSN)”},@{Name=“Passport Number (U.S / U.K)”} - ReportSeverityLevel%%ReportSeverity-2%%]]>      </commandBlock>      </policyCommands>    </dlpPolicyTemplate> </dlpPolicyTemplates>----------------------------------------------------------------------------------------------

The example above may be affected by the substation of two keywords: “%%ReportSeverity−1%%” and “%% ReportSeverity−2%1%” (as given above) aspart of the DLP policy creation from this template using the followingsample syntax:

[PS] C:\>new-DLPPolicy-Template PII-State Audit-Parameters@{“ReportSeverity−1”=“High”; “ReportSeverity−2”=“Low”}

This would result in the creation of the resulting policy directives,possibly implemented through Exchange Transport Rules (ETR), with theparameterized keys substituted with the specified values from the“Parameters” argument. It should be appreciated that this mechanismwould be available for both DLP OOB templates—as well as customtemplates from ISVs and others. If any parameterized properties do nothave corresponding value passed in through the Parameter option, it maybe desirable that an error is generated.

DLP Policy Template Properties

The following table gives some examples of DLP Policy Template objectand their associated properties. It will be appreciated that othertemplate components may be similarly set out.

BASE NAME TYPE RESTRICTIONS DESCRIPTIONS Identity String Guid ID of theobject. Unique and immutable. Can be specified at create time. NameString <64 Unicode A user friendly name to describe chars the object.Recommended to be unique but not enforced by the system. “Name” is analternative mechanism used to identify the object and expected to beused by admins in PowerShell interface. Changeable by user.PublisherName String <64 Unicode Who published this DLP template. charsDescription String Unicode chars Description of the policy template.Regulation String <64 Unicode List of regulations targeted by thiscollection chars per item DLP profile template. Region String 2 charsper item List of countries targeted by this collection DLP profiletemplate. The values are based on the two-letter country codes asassigned part of the ISO 3166-1 Part 1 specification which is commonlyused in Microsoft Windows ® software to specify region designation oflocalization components. Keywords String <64 Unicode Additional keywordsapplicable to collection chars per item the policy used for searchesduring discovery.

DLP Policy Template Operations

The following table gives some examples of DLP Policy Templateoperations and their associated descriptions. It will be appreciatedthat other template operations may be similarly set out.

VERBS DESCRIPTION Get Standard query task. Returns all DLP policytemplates in the deployment environment. Support --- Filter parameter tospecify server side filtering options. Filtering may be based on thefollowing properties: PublisherName, Regulation, Region, Keywords, etc.Import Imports a policy template from a serialized version into adeployment environment. Export Inverse of Import. Exports a serializedversion of the DLP policy template. Remove Removes a DLP policy templatedefinition.DLP Policy Instance

DLP policy instance is the result of creating a DLP policy object from atemplate in a deployment environment. It represents the set ofinstantiated component objects employed to implement the policydefinition in the template (e.g. ETRs, data classification rules etc.).An instance is deployment-specific—i.e., it tends to contain definitionsthat reference components and elements that are specific to a customerenvironment and hence it tends to be non-portable across deployments.

Unlike a template, a DLP policy instance has state which represents thelifecycle state within the customer's deployment (for example, audit orenabled). The DLP policy state may be used to control the state of thecomponents that comprise the policy. Changes in the DLP policy instancestate apply corresponding changes within the policy objects controlledby the DLP policy. Three basic states exist for a policy whichrepresents a customer's progression in realizing their policyimplementation. The following table gives one embodiment of a statetable of a DLP policy instance:

STATE DESCRIPTION Audit Customer is collecting data on what kind ofcontent is being sent through his mail flows without modifying anybehavior. This may be used to adjust/tune policies or to determineimpact and/or actions that would result from enabling the policy. NotifyClient is moving to start to educate the users on the DLP policies inplace and get them familiar with the business processes around sensitivecontent. It may desired to selectively enable enforcement actions, oralternatively, not to enable enforcement actions at all. Enforcement Allaspects of the policy are enabled.

In one embodiment, it may be desirable that there are no restrictions interms of the movements between the states. A customer may choose to skipany of the policy or move from any one state to another. In addition tocontrolling the policy deployment states, the policy may also bedisabled—which results in the policy being ignored in the policyenforcement points.

While the DLP policy is used to control the state of the sub-components,it is possible for the sub-components representing the individual policydirectives (e.g., ETRs) to have a different state than the DLP-policy.This may allow the user to change the individual policy directive of thepolicy to be in a different state—for example, when adding a newdirective to the policy or when troubleshooting a directive of thepolicy. Each policy directive may also maintain a correspondingrepresentation of its state which maps to the values of the DLP policystate. These states may also be controlled independently at thedirective level. For example, the audit state for a directive may beturned-off; by setting the directive in a disabled state. Similarly,Notify state may be turned off for a specific directive.

DLP Policy Properties

In one embodiment, the DLP policy may follow common set of propertiesexposed across other components that comprise the application area—e.g.,Microsoft Exchange® system—and may include the following properties:

BASE NAME TYPE RESTRICTIONS DESCRIPTIONS Identity String Guid ID of theobject. Unique and immutable. Can be specified at create time. NameString <64 Unicode A user friendly name to chars describe the object.Recommended to be unique but may not be enforced by the system. Name maybe an alternative mechanism used to identify the object and expected tobe used by admins in PowerShell interface. May be changeable by theuser. Description String Unicode Description of the policy charstemplate. State Enum Indicates the desired state of the DLP policy andits sub-components. While the DLP policy is used to control the state ofthe sub- components, it is possible for the sub-components to have adifferent state than the DLP policy.

DLP Policy Object Operations

In one embodiment, the main DLP policy object may follow common set ofoperations exposed across other components that comprise the applicationarea—e.g., Microsoft Exchange® system—and may include the followingoperations:

VERBS DESCRIPTION New Creates a new DLP policy from a templatedefinition. The template may be an OOB template; or the contents of atemplate obtained from an ISV or other third party. If no templatedefinition or content is specified, an empty DLP policy may be createdwith no policy elements. Get May be a standard query task. Returns allor a subset of DLP policies in a tenant's space. DLP policy instancesmay be scoped to within a tenant scope since they represent the tenant'simplementation of the policy components. Set The Set operation may beused to modify parameters of the policy. May be used in the change of aDLP policy's state which may also change the state of other policycomponents that support state semantics. Remove The Remove operation maydelete the DLP policy and its associated components from the system. Theuser may be requested to confirm if policy and data classificationobjects should be removed from the system. Import- TheImport-DLPPolicyCollection may allow the serializationDLPPolicyCollection of the policy components for backup/transport andmaintenance. The Import-DLPPolicyCollection may re- create the policycomponents from a previously serialized version. Export- TheExport-DLPPolicyCollection may allow the serializationDLPPolicyCollection of the policy components for backup/transport andmaintenance.

In one embodiment, a single DLP policy instance may have 0 to N policydirectives that implement its behavior. This may be delivered through,e.g., Microsoft Exchange® transport rules. A transport rule may be partof 0 or 1 DLP policy instances. A single policy directive may allow thedefinition across any number of policy enforcement points, for examplefor both server side mail flow processing directives and the e-mailclient processing directives.

In addition, a single DLP policy instance may have 0 to N dataclassification objects bound to it. The data classificationspecification defines what is considered sensitive content within thescope of the policy and how this content should be identified with thee-mail content. The interface for managing the DLP policy instanceobjects may be PowerShell, web interface or others. The DLP Policy maycomprise the same or similar Verbs as disclosed for the DLP PolicyOperations, as given above.

What has been described above includes examples of the subjectinnovation. It is, of course, not possible to describe every conceivablecombination of components or methodologies for purposes of describingthe claimed subject matter, but one of ordinary skill in the art mayrecognize that many further combinations and permutations of the subjectinnovation are possible. Accordingly, the claimed subject matter isintended to embrace all such alterations, modifications, and variationsthat fall within the spirit and scope of the appended claims.

In particular and in regard to the various functions performed by theabove described components, devices, circuits, systems and the like, theterms (including a reference to a “means”) used to describe suchcomponents are intended to correspond, unless otherwise indicated, toany component which performs the specified function of the describedcomponent (e.g., a functional equivalent), even though not structurallyequivalent to the disclosed structure, which performs the function inthe herein illustrated exemplary aspects of the claimed subject matter.In this regard, it will also be recognized that the innovation includesa system as well as a computer-readable medium havingcomputer-executable instructions for performing the acts and/or eventsof the various methods of the claimed subject matter.

In addition, while a particular feature of the subject innovation mayhave been disclosed with respect to only one of several implementations,such feature may be combined with one or more other features of theother implementations as may be desired and advantageous for any givenor particular application. Furthermore, to the extent that the terms“includes,” and “including” and variants thereof are used in either thedetailed description or the claims, these terms are intended to beinclusive in a manner similar to the term “comprising.”

What is claimed is:
 1. A computing system comprising: a processor; and memory storing instructions which, when executed, configure the computing system to: identify a first electronic file system configured to provide a first service to a set of clients that request access to data associated with the first electronic file system, the first electronic file system having a first set of file system characteristics representing operation of the first electronic file system; identify a second electronic file system configured to provide a second service to a set of clients that request access to data associated with the second electronic file system, the second electronic file system having a second set of file system characteristics representing operation of the second electronic file system; receive a data loss prevention (DLP) policy template that comprises a set of template component fields, and is generic to both the first and second electronic file systems; and for the first electronic file system, transform the generic DLP policy template into a first DLP policy instance that is specific to the first electronic file system by parameterizing the set of template component fields based on the first set of file system characteristics, wherein the first DLP policy instance comprises: a policy rule object that defines a DIP action to be performed by the first electronic file system; and a data classification rule object defining a structure of electronic data in the first electronic file system to which the policy rule object is applied; and control operation of the first electronic file system by executing the policy rule object of the first DLP policy instance; and for the second electronic file system, transform the generic DLP policy template into a second DLP policy instance that is specific to the second electronic file system by parameterizing the set of template component fields based on the second set of file system characteristics, wherein the second DLP policy instance comprises: a policy rule object that defines a DLP action to be performed by the second electronic file system; and a data classification rule object defining a structure of electronic data in the second electronic file system to which the policy rule object is applied; and control operation of the second electronic file system by executing the policy rule object of the second DLP policy instance.
 2. The computing system of claim 1, wherein each of the first and second electronic file systems comprises a file server in communication with the set of clients that request access to data associated with the file server.
 3. The computing system of claim 1, wherein the first service comprises a different type of service than the second service.
 4. The computing system of claim 3, wherein each of the first and second file servers comprise one of: an information protection and collaboration system, a web server, an application server, an email server, or an information management and collaboration server.
 5. The computing system of claim 1, wherein the set of template component fields of the selected DLP policy template is parameterized with replacement values based on a specification of a substation key comprising a construct within the selected DLP policy template.
 6. The computing system of claim 1, wherein the instructions configure the computing system to control a state of each of the first and second DLP policy instances.
 7. The computing system of claim 6, wherein the DLP policy instance comprises a state table that stores a state of each of the first and second DLP policy instances.
 8. The computing system of claim 7, wherein the state table stores a state comprising at least one of: Audit, Notify, or Enforcement.
 9. A computing system for creating a data loss prevention (DLP) policy instance for a set of email systems, each email system comprising an email server configured to communicate with a set of email clients, the computing system comprising: a processor; and memory storing instructions executable by the processor, wherein the instructions, when executed, configure the computing system to: receive a DLP policy template that comprises a set of template component fields and is generic to the set of email systems; and for each email system in the set of email systems, transform the generic DLP policy template into a DLP policy instance that is specific to the email system by parameterizing the set of template component fields based on policy data associated with the email system, wherein the DLP policy instance comprises: a policy rule object that defines a DLP action to be performed by the email system; and a data classification rule object defining a structure of electronic data in the email system to which the policy rule object is applied; and control operation of the email system by executing the policy rule object of the DLP policy instance.
 10. The computing system of claim 9, wherein the instructions configure the computing system to control a state of the DLP policy instance.
 11. The computing system of claim 9, wherein the DLP policy instance comprises a state table that stores a state of the DLP policy instance.
 12. The computing system of claim 9, wherein the instructions configure the computing system to: replace values in the DLP policy template based on a specification of a substation key, the substation key comprising a construct within the DLP policy template.
 13. The computing system of claim 9, wherein the instructions configure the computing system to: monitor and control a state of the DLP policy instance, wherein the state of the DLP policy instance is stored in a state table associated with the DLP policy instance.
 14. A method performed by a computing system, the method comprising: identifying a first electronic file system configured to provide a first service to a set of clients that request access to data associated with the first electronic file system, the first electronic file system having a first set of file system characteristics representing operation of the first electronic file system; identifying a second electronic file system configured to provide a second service to a set of clients that request access to data associated with the second electronic file system, the second electronic file system having a second set of file system characteristics representing operation of the second electronic file system; receiving a data loss prevention (DLP) policy template that comprises a set of template component fields, and is generic to both the first and second electronic file systems; for the first electronic file system, transforming the generic DLP policy template into a first DLP policy instance that is specific to the first electronic file system by parameterizing the set of template component fields based on the first set of file system characteristics, wherein the first DLP policy instance comprises: a policy rule object that defines a DLP action to be performed by the first electronic file system; and a data classification rule object defining a structure of electronic data in the first electronic file system to which the policy rule object is applied; and controlling operation of the first electronic file system by executing the policy rule object of the first DLP policy instance; and for the second electronic file system, transforming the generic DLP policy template into a second DLP policy instance that is specific to the second electronic file system by parameterizing the set of template component fields based on the second set of file system characteristics, wherein the second DLP policy instance comprises: a policy rule object that defines a DLP action to be performed by the second electronic file system; and a data classification rule object defining a structure of electronic data in the second electronic file system to which the policy rule object is applied; and controlling operation of the second electronic file system by executing the policy rule object of the second DLP policy instance.
 15. The method of claim 14, wherein each of the first and second electronic file systems comprises a file server in communication with the set of clients that request access to data associated with the file server.
 16. The implemented method of claim 14, wherein the first service comprises a different type of service than the second service.
 17. The method of claim 16, wherein each of the first and second file servers comprise one of: an information protection and collaboration system, a web server, an application server, an email server, or an information management and collaboration server.
 18. The method of claim 17, wherein the generic DLP policy template is transformed into the first and second DLP policy instance comprises: translating generic policy constructs into deployment specific objects.
 19. The method of claim 17, wherein transforming further comprises: translating generic policy constructs into localized language contexts.
 20. The of claim 14, and further comprising: changing the state of each of the first and second DLP policy instances according to a lifecycle of the policy instance deployments. 